2ee3b5af1e9b4a765319279f7bfd485a1c8f908895e83ef81b29641e503d9f64

Analysis

max time kernel
93s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05/11/2024, 15:02

Target

2ee3b5af1e9b4a765319279f7bfd485a1c8f908895e83ef81b29641e503d9f64N.exe
Size

426KB
MD5

0056c7e0fc0b4b72d8317365dcff2880
SHA1

880e1da029fe1830a91946e86542e2642135dc90
SHA256

2ee3b5af1e9b4a765319279f7bfd485a1c8f908895e83ef81b29641e503d9f64
SHA512

6562b0e52e0c13febaac961b2b4259aa7deb6bf73a55d923f0e5cfef762f438d7d65e0e760af1e0b04978214f0bddab8498e1271ad085391759f5a2986b371d5
SSDEEP

6144:8Z5f30291xuMHlpw9wrvwewMdBtbIbd5xv6P/6CuCNJ0hOYj:8nk291kMHlpw6r4eL3IbxvoyClwzj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 3048	1064	2ee3b5af1e9b4a765319279f7bfd485a1c8f908895e83ef81b29641e503d9f64N.exe	30
PID 1064 wrote to memory of 3048	1064	2ee3b5af1e9b4a765319279f7bfd485a1c8f908895e83ef81b29641e503d9f64N.exe	30
PID 1064 wrote to memory of 3048	1064	2ee3b5af1e9b4a765319279f7bfd485a1c8f908895e83ef81b29641e503d9f64N.exe	30

C:\Users\Admin\AppData\Local\Temp\2ee3b5af1e9b4a765319279f7bfd485a1c8f908895e83ef81b29641e503d9f64N.exe
"C:\Users\Admin\AppData\Local\Temp\2ee3b5af1e9b4a765319279f7bfd485a1c8f908895e83ef81b29641e503d9f64N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1064 -s 76
  2⤵
  PID:3048